Duolingo: Language Lessons Security & Privacy Scorecard

Duolingo: Language Lessons

Package: com.duolingo | Version: 6.63.4 (Build 2278) | Platform: Android | Analyzed: 2026-01-25

What This Means for You

In-app behavior is recorded by a session replay tool, meaning taps and learning activity may be watched in detail. User data is shared with over a dozen ad and analytics companies, including TikTok, Facebook, and Unity Ads, for targeted advertising. Users have limited ability to opt out of this data collection.

Recommendation: Use With Caution

Best For: Language learners comfortable with ad-supported apps
Avoid If: Users who prefer to limit apps with session recording tools

Key Findings

Data Security - 7 findings (2 critical, 1 high, 4 medium)

Network Security - 5 findings (1 high, 4 medium)

Code Safety - 0 findings

Privacy - 4 findings (1 critical, 3 high)

Privacy Concerns

What Data is Collected

Detailed behavioral data is collected about how users interact with the app, including which lessons they complete, how long they spend on each screen, and the specific taps and gestures they make. Session recording technology captures a replay of in-app activity for later review. Crash and performance data is also collected. Device identifiers and usage patterns are gathered for advertising targeting.

Third-Party Data Sharing

Activity data is shared with 14 third-party companies across advertising, analytics, and support:

• FullStory - Records and replays in-app behavior
• Adjust - Tracks where users came from before installing the app
• Firebase Analytics - Monitors how users use the app
• Firebase Crashlytics - Collects crash reports
• IronSource - Ad mediation and delivery
• Unity Ads - Delivers in-app ads
• Vungle - Delivers in-app ads
• ByteDance/TikTok Ads - Serves ads across TikTok properties
• Facebook Audience Network - Serves targeted ads via Facebook
• Facebook SDK - Enables Facebook-based features and ad targeting
• Google Play Services - Platform integration and advertising
• WeChat SDK - Enables WeChat-based social features
• Sentry - Monitors app errors
• Zendesk - Powers in-app customer support

Understanding the Scores

Positive Security Features

• Relies on standard Android platform security defaults only.

Areas for Improvement

• Reduce third-party data sharing. User activity is currently shared with 14 separate companies for advertising and analytics purposes. Limiting sharing to only what is strictly necessary would meaningfully reduce how broadly user data circulates.
• Give users real control. The User Control score of 30/100 reflects that users have very few options to limit what is collected or shared. Providing accessible, in-app privacy controls would give users more control over their own data.
• Improve how personal data is protected within the app. The Data Security score of 40/100 reflects areas where the handling of user data inside the app falls short of current best practices.

About This Analysis

This scorecard is generated from automated static analysis of the app's compiled code and configuration. Findings represent capabilities observed in the app's code as of the scan date.

App Details